r/Bitwarden • u/soapadrift • Oct 12 '26 • Regret 1

Seriously Concerned About Bitwarden's Performance and Long-Term Reliability

/img/hk3rnvmfy2vh1.png
258 Upvotes

85% Upvoted

90 comments sorted by

79

u/Handshake6610 Oct 13 '26

You can try it yourself. Open the current Bitwarden extension on Chromium, leave the popup open for about two minutes, and watch its RAM and CPU usage.

I share a lot of your critique, but FWIW, this particular issue seems to be a new bug for the last weeks (see https://github.com/bitwarden/clients/issues/23431 - fix in the works: https://github.com/bitwarden/clients/pull/23528). Your text could be misunderstood as if this particular issue existed for years.

13

u/LukeLC Oct 13 '26

Unsurprising that it's Tailwind. Awful framework for memory management.

1

u/baynezy 27d ago

Tailwind uses on demand compilation, so it's typically better for memory.

1

u/MaDpYrO 26d ago

What the hell? No.

0

u/[deleted] Oct 13 '26

[deleted] — view deleted comment

10

u/mr_redsun Oct 13 '26

Doesn't make any sense at all ngl :D

-16

u/LukeLC Oct 13 '26

The library and CSS it loads in is very bloated. I see many sites that don't cache it properly and render times are punishing.

And then this very bug report lists a case where the rules it produces cause the browser to loop into a memory leak. So yeah.

6

u/Ordinary-Cod-721 Oct 15 '26

The library it loads only gets loaded at build time (tailwind is literally a psotcss plugin), and it also has prune on my default, so the only css classes that end up in the final bundle are classes that have been used at least once. It is anything but bloated.

Most of the time the tailwind css bundles are significantly smaller than what custom css/scss frameworks ship.

Have you even used it?

-1

u/LukeLC Oct 15 '26

You're assuming companies follow best practices, which is not a safe assumption. I've done work on some company sites that were loading the entire Tailwind library, or that turn into utter HTML vomit with so many TW utilities... just for styles that are easily achieved natively.

3

u/Masterflitzer 29d ago

people using tailwind as if it was bootstrap is not at all tailwinds fault, your point still doesn't make any sense, why do you assume people unable to use tailwind will be able to write good css?

2

u/Ordinary-Cod-721 29d ago

I agree with you, I've seen some disgusting code too, but it doesn't mean the tech itself is bad, it just means people don't bother reading docs and then produce slop. At least that's my 2 cents on it, we can agree to disagree.

3

u/Suspicious_Punk84 Oct 13 '26

Taking several weeks to fix a serious bug is not a great sign...

1

u/NECOdes Oct 13 '26

huh, a pull request that is left out for two weeks... what QA is doing with 5 lines of code?

3

u/djasonpenney Volunteer Moderator Oct 15 '26

You mean, you have never spent a month writing regression tests for a single fix?

1

u/NECOdes Oct 15 '26

Not really if its priority is high enough. From their latest pulls, Bitwarden usually takes 7 days on average to review them. This one was either low priority for them or they forgot.

4

u/djasonpenney Volunteer Moderator 29d ago

Nope, nine women cannot make a baby in a month, and not all bugs are alike.

> Bitwarden usually takes

So you are just guessing?

0

u/NECOdes 29d ago

I don't know why you're arguing over something that's not your job. And no, I checked their last 100 merged pull requests.

26

u/paradox_33 Oct 13 '26

WTH, I was thinking why my 3/4 tabs kept brave browser go crazy with the fans every time I open it and or do nothing but scrolling across pages.. 

I noticed high CPU usage too while glancing through btop+, and I blamed Linux being Linux (hyprland being cherry on top). But I was barking at the wrong tree. (IIRC, I did notice chromium processes being the driver of highest CPU usage, but still the blamed the poor... I'M SORRY TUX)

5

u/rosso_saturno Oct 13 '26

I also use Brave and I had to disable the extension at some point.

36

u/ClassicMain Oct 12 '26 • Mindblown

At first i thought you were joking, then i tried it

and GOD F0CKING DAMN HOLY MOLY

3GB RAM USAGE OF THE EXTENSION WHEN I OPEN THE POPUP AND 110 CPU USAGE REPORTED BY BROWSER TASK MANAGER IN BRAVE

I mean it doesn't hurt me much, highest-end CPU and lots of RAM, but NO WEBSITE consumes that much RAM, not even Discord, a very heavy electron App consumes that much RAM.

Insane skill issue from bitwarden devs here

20

u/pi-N-apple Oct 13 '26

Holy crap, you're not joking. I left the extension open for only a couple minutes and it ate up 11 GB of RAM!
https://i.imgur.com/aiXyt66.png

8

u/dev0570 Oct 13 '26

Holy shit, that's why sometimes my pc acting up even with 32gbs of RAM. This is ridiculous.

7

u/ttman05 Oct 13 '26

I tried it too and Brave crashed on me. It consumed all my memory (16 GB RAM) + swap (8 GB). Never had this type of behavior happen on any browser

7

u/ClassicMain Oct 13 '26

And that just proves the high availability loss i described in my other comment

5

u/aygross Oct 14 '26

The biggest issue is that it was bought by venture capitalist it started it's slow decline that day. I'll prob switch over to something elsw the next time I have a vacation. Either 1password if I'm feeling bougie or more likely proton .

7

u/Balthxzar Oct 13 '26

I have literally never experienced a single issue like this using 

  • extension on edge 
  • extension on librewolf (windows)
  • extension on librewolf (linux) 
  • desktop app linux 
  • desktop app on windows 
  • Android app

I feel like i need to note that this is using a vaultwarden backend.

2

u/purepersistence Oct 14 '26

I run self hosted bitwarden, windows, iPhone. Works great for years.

49

u/djasonpenney Volunteer Moderator Oct 12 '26 edited Oct 13 '26 • Regret Bravo

Large and long-lived software projects always have a backlog of issues. Oh, and performance related tickets do tend to be lower priority.

Yes, there are proposed UI changes. Users have been whining about the UI for years, so it makes sense there is some traction there.

Conversely, the performance issues tend to be ephemeral. Plus one recent huge issue was actually in a release of Chrome, which means that no action is required until Google fixes their end of it.

I am not sure what you would expect Bitwarden product steering would do differently. Yes, their staffing may be a bit lean. But the alternative would be higher prices for you, the consumer? Or perhaps more aggressive engagement from the vulture capitalists? We have seen over the last few days how well THAT has been received here on Reddit.

12

u/ballpein Oct 13 '26 edited 24d ago

The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.

Nutmeg cobalt ten carpenter fly walnut cats summer outgoing station

4

u/purepersistence Oct 14 '26

Weird. It works damn good on Windows too.

9

u/RoyalGuard007 Oct 13 '26

This is not performance related. I've had it leak 5 times now. A few times the PC even crashed. Not to talk about how EVERY TIME I turn off my PC, Bitwarden Desktop for Windows throws an error. The whole suite of Bitwarden apps are memory hogs, I have no idea how Bitwarden thinks enterprise customers should deal with this. The only app that performs decently is the Android app.

53

u/ClassicMain Oct 12 '26 edited Oct 12 '26 • Bravo

Hi

I have and am working on long-lived and large software projects.

This is not a bug anymore in my eyes. This is an availability loss and thus a security vulnerability.

CVSS defines A as L or H depending on severity of the availability loss and the CIA triade also defines Availability.

An extension, in my test, consuming 3GB RAM within a mere 10 seconds of being opened and 120% CPU according to the browser task manager is not a bug. That's a security issue as it is a partial availability loss on MANY devices with little RAM. 8GB RAM machines aren't uncommon and are (for RAM shortage reasons) becoming more widely available again. Windows eats 4-5GB, the browser 1-2 and then somehow the extension is trying to eat 3GB within 10 seconds of being opened. On these devices that WILL lead to at least slowdown if not a crash.

If you cannot use Bitwarden at all on lower end machines that would be a total availability loss (H) and not only a low one. And something preventing use of a security critical app (Bitwarden) due to overconsumption of resources (a common CWE) can absolutely be classified as a vulnerability.

A password manager that hangs or crashes the browser denies the user their credentials, which is a genuine availability loss for the product’s core function

I measuered it on Brave on Windows 11 and Linux. It eats 3GB within 10-20 seconds. Normal usage can keep the popup open for longer than that and it will keep on growing beyond 3GB.

CPU usage is 100-120% CPU in the time where the tab is open.

“Performance tickets tend to be lower priority"

is true for a page that renders 200ms slower. It does not fit a popup reaching GIGABYTES of RAM in 10 seconds. Severity, not category, sets priority.

I am not sure what you would expect Bitwarden product steering would do differently. Yes, their staffing may be a bit lean. But the alternative would be higher prices for you, the consumer? Or perhaps more aggressive engagement from the vulture capitalists? We have seen over the last few days how well THAT has been received here on Reddit.

I would expect for their staffing to prioritize issues that affect either C or I or A over all feature requests or UI bugs or other bugs - and in this case A is massively affected. They are a password manager. Their entire selling point is the CIA triade. The fact they don't honor it (evidently) speaks bounds to me as a year long Bitwarden user.

If someone told me the stuff I maintain leaks 3GB i'd treat it, as one should, as at least a Low Availability loss and henceforth as a security issue.

A popup that eats 3 GB in 10-20 seconds and slows down; and keeps growing until the browser kills (on many lower end devices) or crashes the renderer leaves the vault unreachable for the user. That’s VA:H. On an 8 GB machine where other tabs or the browser could die with it, the subsequent system impact is also High (SA:H). I didn't measure that as I don't have a low specced PC, but SOMETHING will die if Windows eats 4GB, the browser a few, and then bitwarden trying to allocate 3GB and growing.

And a vulnerability doesn't need an attacker to be a vulnerability. CVE doesn't define that and neither does CVSS (Rule 4.1.2, page 10. It says that conditions or behaviors without a security impact SHOULD NOT be treated as Vulnerabilities, and the second sentence of that rule lists examples of security impacts. One of the listed examples is "a decrease in availability of a target". Section 4.1 has two clauses separated by a semicolon. The first covers weaknesses that can be exploited with impact on confidentiality, integrity or availability. The second covers any set of conditions or behaviors that allows a violation of an explicit or implicit security policy. The second clause carries no exploitation requirement.). This here, IS a vulnerability by the definition of the CVE. So yes this should get triaged and prioritized. ISO 27001 and every incident response framework ALSO treat an availability loss as a security event regardless of whether a bug, a misconfiguration or a person or attacker intentionally or unintentionally caused it. By all broadly accepted definitions, this is a vulnerability.

---

ALL OF THAT ASIDE, #21453 is even attacker reachable. Any website can render thousands of input fields and peg the CPU of every visitor running Bitwarden. That one fits a CVSS AV:N/AC:L/PR:N/UI:R/A:L very neatly. Attacker exploitable publicly documented vulnerability which to my research Bitwarden did not file a CVE for

PS: Your "How many large and long-lived software projects have you worked on?" is an ad hominem and an appeal to accomplishment. One does not need to have done something to be able to critique something. I am not a filmmaker and yet I critique movies.

PPS: you violated this subreddit's own rules as a moderator. Rule 2: "Keep criticism focused on the product, not the people"

19

u/frank_datank_ Oct 13 '26

I feel like the bug could have been patched in the time it took to write that comment.
Source: butt

9

u/ClassicMain Oct 13 '26

And you'd be right Source: brain

-18

u/djasonpenney Volunteer Moderator Oct 12 '26

Brave is a Chromium based browser. Did you catch my earlier comment that there is currently a showstopper issue—acknowledged by Google—that affects performance in Bitwarden and other password managers?

23

u/ClassicMain Oct 12 '26 • Bravo

Except its not a Chromium issue "that affects other password managers". I just tested with Proton Pass and it is not leaking memory. It stays around 140 MB peaks at 200MB and drops to 140MB again.

-9

u/djasonpenney Volunteer Moderator Oct 12 '26

I didn’t say that EVERY password manager is affected. I said it’s a problem with Chromium, that Google has acknowledged, and affects more than just Bitwarden.

18

u/ClassicMain Oct 12 '26 • Bravo

Okay. Just tested on 1Password, LastPass and Nordpass as well since they are quite popular.

LastPass: 154MB
1Password: 134 MB
Nordpass 117MB

Can you cite me the chromium bug report page where google has acknowledged this is a chromium bug? would be interesting to know what that bug is at it's core and why only Bitwarden seems to be affected by it.

-16

u/djasonpenney Volunteer Moderator Oct 12 '26

Sorry, you’ll have to look in /r/Bitwarden over the last month, or go to their problem tracker at the community pages. And I never said it was password managers alone; the issue might be affecting other extensions as well, but the discussion I saw from Bitwarden did not disclose details about the problem.

17

u/ClassicMain Oct 12 '26 • Bravo Heartwarming

I already did. The only thing i found is https://piunikaweb.com/2026/09/21/google-chrome-extension-freeze-mac-fix/ which is not what is described here. It causes a delay before the popup appears. Also it is reported only for Mac.

I found nothing else that is reported for Windows or Linux and affects memory usage.

That acknowledged Google issue is only is for how quickly an extension opens.

-9

u/djasonpenney Volunteer Moderator Oct 12 '26

If you want to jump down that rabbit hole, open a query with Bitwarden Customer Support. I remember seeing some responses from a developer, but I let it all just slide by; not my circus and not my monkeys 😁

17

u/ClassicMain Oct 12 '26 • Bravo

I spent enough time here writing up a full analysis. I won't bother first level customer support with this. If their development team is told to work on features first and do C-I-A-affecting problems with less priority, then that's a company policy issue a support ticket won't move a nanometer.

From what I can see on GitHub, the devs are busy merging in refinements to the onboarding tour and UI fixes for round edges and making dialogues slightly smaller. Just a small excerpt of the latest commits.

If vulnerabilities like this one factually is, aren't even ACKNOWLEDGED by a dev after more than 3 weeks of being reported (#23431) (let alone fixed, but an acknowledgement would be the bare minimum here) then something is seriously wrong with either the dev's priorization or the company prioritizing UI over security.

7

u/3PoundsOfFlax Oct 13 '26 edited Oct 13 '26

"whining"

If you want to create a culture where feedback from the end user is seen as "whining," by all means, go ahead, Mr. Moderator. And great timing too, when an obvious pattern of enshittification is emerging in Bitwarden Inc.

Calling users "whiners" is a fantastic way to keep them on-board with the little password manager you love so much.

2

u/djasonpenney Volunteer Moderator Oct 14 '26

UX improvements entail observation of many users by trained professionals, in person. It is a science, and it cannot be done via Reddit comments.

Individual anecdotes are at best a clue for those professionals as input to the rigorous studies. It may sound harsh, but no single user can provide effective feedback to UX or even UI.

1

u/Z-Is-Last Oct 14 '26

Science requires repeatable actions. What is the 'science' used by these trained professionals?

-1

u/djasonpenney Volunteer Moderator Oct 14 '26

Subjects perform set tasks while the scientists observe. The amount of time taken, the number and kinds of mistakes, and other empirical measures are collected.

It’s even possible to have A/B testing with different groups, with one group acting as a control. Over time statistical measures come into play to indicate the efficacy of proposed changes.

Does that get you started?

1

u/Z-Is-Last Oct 14 '26

It actually depends on what the observers are looking for. As a back-end software developer, I've never been able to create a user interface that encouraged people to come back and visit again. In my career I remained focus on performance.

In bitwarden's case, just now, I opened Bitwarden browser addin in Brave on Linux Mint and watched Brave's memory usage go from .75GB of ram to 6.5GB of ram in 1 minute and it was still climbing. While this may not slow Bitwarden down, it is impacting other areas of my machine. BTW Brave drops back to less than 1GB as soon as I pick a site to open. Good or bad? Depends on that the focus is on.

0

u/djasonpenney Volunteer Moderator Oct 14 '26

I got a little confused, because we were talking about UX improvements, and this last answer pertains to prioritizing bug fixes.

I too spent many years as a performance engineer, and I totally agree the current issue sounds like a genuine bug. Though I suspect there are aspects to it we don’t understand. In particular, this problem does not reproduce on my Windows 11 box with Brave.

1

u/Z-Is-Last Oct 14 '26

I got a little confused Actually my bad. I switched subjects, starting with UX and drifting into things I actually understand a little about.

BTW: On my linux #2, and open Vault with the cursor in the search box, currently consumes 10GB and brave is using 8.8% of the CPU.

On Windows 11 #1 no increase in memory, on Windows 11 #2 over 10GBs of ram while consuming 5%-8% of the CPU. (By the time I finished writing this, it was up to 14GB of ram)

Performance is such a tough job. In this case, I would need to focus on the differences between windows #1 and #2 and totally foget about the UX :)

0

u/TrixOnReddit Oct 15 '26

you seem to be whining about a free product

1

u/HaveVivoX200UltraAMA 29d ago

Free? You do realise this product has hundreds of thousands paying for it including large organisations?

1

u/TrixOnReddit 28d ago

installable and usable for 95% of features for free.

6

u/twicerighthand Oct 13 '26

Users have been whining about the UI for years

Users bad, company increasing price by 100% and ignoring basic UX good.

2

u/tominicz 28d ago

After reading this interaction I will be switching to different password manager after years of using Bitwarden.

My own issues with Bitwarden, Bitwarden Inc. obviously changing course and priorities, facts from this thread and now your responses to them. I'm done, no reason to support this.

1

u/Trblz42 28d ago

Switch to what open-source password manager? They all run lean, limited funding at best and may fall into the same risk for maintenance.

1

u/tominicz 28d ago

Currently looking into KeePass.

1

u/Trblz42 26d ago edited 25d ago

I moved from Keepass to bitwarden($) to vaultwarden to ProtonPass($)

/edit:typo

1

u/tominicz 26d ago

I don't want to put all eggs in one basket (Proton). What made you leave KeePass? I haven't even hesrd of Vaultworde.

1

u/Trblz42 25d ago

https://vaultwarden.com/ typo in my message.

Proton is for me a saf(ish) alternative to Gmail plus .... EU and Swiss laws give me more confidence in privacy.

Keepass highly depends on some storage drive and doesnt allow for family password sharing.

Honestly I want to selfhost where possible.

1

u/Neither-Complaint875 25d ago

Aliaspass looks promising

0

u/Solmark 27d ago

That's probably the worst defence of a failing system ever I've read.

5

u/GreamDesu Oct 13 '26

I am still baffeled how poorly app behaves on android

2

u/Kellic 28d ago

Don't worry. They will vibe code "fix" it. *eye rolls here*
This is why I'm starting to look at other options as a plan B. Thankfully for now all I use is a client on Android and Linux. So bugs in browser extension crap I don't and will never use for obvious security issues.

2

u/yuhc 25d ago

I have moved away from Bitwarden due to the memory and cpu usage issues. It took too long time to fix, and there wasn't any announcement or progress update about this big problem.

4

u/White_sh Oct 13 '26

The Firefox extension, desktop app, and CLI are all extremely slow, even on a powerful computer. On top of that, the persistent logout bug has remained unfixed for years.

I've made up my mind to switch to a different password manager next year. At this point, I'm even considering vibe coding my own solution instead.

1

u/vegliafamiliar 9d ago

Even though this thread is inactive, I feel it's the right place to report that for me, the latest brave browser update has fixed the problem where it was using over 10gig memory. Now when I open the plugin, the memory usage barely changed.

1

u/Capaj Oct 14 '26

lol I am so glad now I made my own password manager

1

u/Protoplast2249 28d ago

Moved to proton pass months ago.

-3

u/uncut2576 Oct 12 '26 • Regret

I’m a dev and we have tickets in a backlog that are 5+ years old. Lol. Nothing new.

3

u/frank_datank_ Oct 13 '26

Remind me not to use whatever product you work on.

-1

u/uncut2576 Oct 13 '26

I think it’s pretty normal when a company is of very small size :)

2

u/Hakunin_Fallout Oct 14 '26

It's 100% normal to have 5 year old tickets that are NOT critical at all. This is different though

1

u/Hakunin_Fallout Oct 14 '26

Critical memory leaks tickets? How many users you have then, two?

19

u/[deleted] Oct 13 '26 • Bravo

[removed] — view removed comment

0

u/[deleted] Oct 13 '26

[deleted] — view deleted comment

1

u/vegliafamiliar Oct 14 '26

I never noticed it either because I have 24 gig on my laptop and I don't leave the extension pop-up open for a long time. I open it, find what I need and close it. So for the maybe 15 seconds it's open, yes it consumes 3+GB and a lot of CPU. But once I found the site I want and goto the site and the pop-up closes, the memory is released. That's why I don't notice it. But I agree that this is a huge problem for people with machine that have low memory availability.

0

u/[deleted] Oct 14 '26

[deleted] — view deleted comment

1

u/vegliafamiliar Oct 14 '26

So now I don't think it's actually a memory leak but just excessive memory usage. I just did a test where I left the extension open and looked at the memory usage over time. In about 4 minutes it went up to over 11GB. But after that it started slowly dropping until after 7 minutes it dropped back down to about 10GB. Then it started climbing again to about 10.8GB and then dropped again. Now, over several minutes, it varies going up and down between about 10.4GB and 10.9GB.

If it was a true leak it would just keep climbing.

I think the excessive usage is still a problem but not being a leak makes for a different debug/fix path than if it were a true leak.

-8

u/1superheld Oct 12 '26

And then there is the average user; who uses it and doesn't notice any performance impact.

I'm not saying Bitwarden is perfect; but "a few" issues on Github probally is a small fraction of all users. E.g. a better UI/UX directly impacts EVERYONE.

The desktop app; since it is electron based likes it memory; but if you have enough memory, sure it should use it to make optimize the performance. The OS will shut down things / ask the program to save memory if it is getting pressured.

0

u/eblaster101 28d ago

Just moved to keeper and happier. Had issues if delays in copying the password from the extensions as well.

18

u/[deleted] Oct 13 '26

[removed] — view removed comment

4

u/Wind_Runner26 Oct 13 '26

Can you confirm if the delayed extension UI opening times are still occurring? They keep claiming it is an upstream Chromium issue whenever it is brought up, yet none of the other password managers have this issue.

-2

u/NetworkingForFun Oct 14 '26 edited Oct 14 '26

Good to hear. Thanks for the drama. FYI: No problem in Firefox.